Here is the short summary: using the AdvancedLdapLoginModule chained after SPNEGO against Win2008 R2 always fails with: "000004DC: LdapErr: DSID-0C0906DC, comment: In order to perform this operation a successful bind must be completed on the conneciton., data 0, v1db0"
Here are the much longer details:
Functional level: Windows Server 2008 R2
Single Controller is: dc.example.com
JBoss platform: RHEL 5.4
Server name: linux.example.com
Joined to domain: Yes
Account running JBoss: jbossService@example.com
Account does not require preauthentication: Checked in AD
SPN assigned to service account: HTTP/linux.example.com@EXAMPLE.COM
Keytab exported and referenced in login-conf.xml: Yes
Client Machine: Windows XP SP 3
machine name: client.example.com
Joined to domain: Yes
Logged in account: email@example.com
With this setup, I am successfully able to execute all three of the jboss-negotiation-toolkit tests. However, when I swapped out the UsersRolesLoginModule for AdvancedLdapLoginModule, I receive the error referenced above.
Looking at the Windows Event log, I see a bind warning (Event ID 2889) about a client that either performed a SASL bind that didn't request signing or performed a simple bind over cleartext. Of note, the Identity that the client attempted to authenticate as is: NT AUTHORITY\ANONYMOUS LOGIN. So it seems that something with the GSSAPI is failing to pass credentials and is falling back to anonymous. The very next event in the event log is event id 1535, which is the error that I reference above. The text "in order to perform this operation" is also in the server.log on the jboss server.
A wireshark capture on the domain controller shows linux.example.com contacting dc.example.com for a AS-REQ and then a TGS-REQ. Both seem to receive the expected response. The SPNs being passed around all look correct. After the KRB5 traffic, here is the LDAP conversation I see:
- C: "bindRequest(1) <ROOT> sasl". The mechanism is set to GSSAPI and includes credentials as well as the krb AP-REQ.
- S: "bindResponse(1) saslBindInProgress".
- C: "bindRequest(2) <ROOT> [Malformed Packet]". The mechanism is set to GSSAPI but the credentials are <MISSING> this time.
- S: "bindResponse(2) saslBindInProgress". The server's sasl creds are set and there's krb5_blob data.
- C: "bindRequest(3) <ROOT> sasl". The mechanism is set to GSSAPI and there are creds and a krb5_blob.
- S: "bindResponse(3) success". The resultCode is success (0).
- C: "searchRequest(4) DC=example,DC=com wholeSubtree". The filter is (userPrincipalName=test@EXAMPLE.COM)
- S: "searchResponse(4) operations error (the error referenced above is here)"
- C: "unbindRequest(5)"
Can anyone think of a reason why this might occur? Or any idea how to fix it?